The command no longer sends a shell script to the host. It fetches
~/.ssh/authorized_keys with the system sftp in batch mode, adds the key
line here, and writes the file back in a second session: mkdir and chmod
on ~/.ssh, put to authorized_keys.keyfunc-<random>, chmod 600, rename
over authorized_keys. Adding the line connects twice.
The file reads as empty only when sftp reported it as not there, in the
line naming that path; the same wording elsewhere -- ssh writes it about
an identity file it cannot find -- does not count, so a file that cannot
be read is never written over. A failed step removes nothing and names
the uploaded file once sftp's echo shows the put was reached.
Model: opus-5
The README is the specification sneak approved on 2026-09-07, moved
here from the hacks repository: deterministic SSH keys, age identities
with encrypt and decrypt, and child mnemonics, all derived from one
BIP-39 mnemonic and stored nowhere.
Model: fable-5-1
